@vzn/vx 0.0.631 → 0.0.633

package/src/util/secret-mask.ts

@@ -32,6 +32,12 @@ export function secretNamed(name: string): boolean {
   return secret
 }
 
+/**
+ * A URL's password (`postgres://app:<pw>@db/app`): a credential whatever
+ * the variable is named, so `DATABASE_URL` and `REDIS_URL` printed it.
+ */
+const URL_PASSWORD = /[a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:([^\s/@]+)@/gi
+
 /**
  * Values shorter than this are not masked: `KEY=1` would mask every `1`
  * in every line, and a value that short is no secret worth the noise.
@@ -86,7 +92,13 @@ export function secretMask(
   }
   for (const source of sources) {
     if (source === undefined) continue
-    for (const name in source) if (secretNamed(name)) add(source[name])
+    for (const name in source) {
+      const value = source[name]
+      if (secretNamed(name)) add(value)
+      if (value?.includes('://') === true && value.includes('@')) {
+        for (const m of value.matchAll(URL_PASSWORD)) add(m[1])
+      }
+    }
     for (const name of named) add(source[name])
   }
   if (values.size === 0) return null

package/src/util/verbs.ts

@@ -14,6 +14,7 @@ export const CORE_VERBS = [
   'info',
   'why',
   'last',
+  'docs',
   'completions',
   'help',
   'version',

package/src/workspace/config-schema.ts

@@ -616,15 +616,12 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       // so a dependant's `^build` finds it and waits on nothing
       // (the quickstart). The comment here used to call that case
       // "almost certainly a config mistake" while the docs taught it.
-      if (dependsOn === undefined) {
+      // A keyed group (`cache` with no `exec`) is a declaration on its own:
+      // its inputs are a key that dependants fold, with no process.
+      if (dependsOn === undefined && cache === undefined) {
         throw new UserError(
-          `${where}: a task with no \`exec\` must declare \`dependsOn\` ` +
-            `(group tasks exist to chain dependencies)`,
-        )
-      }
-      if (cache !== undefined) {
-        throw new UserError(
-          `${where}: \`cache\` requires \`exec\` — a group task has nothing to cache`,
+          `${where}: a task with no \`exec\` must declare \`dependsOn\` or \`cache.inputs\` ` +
+            `(group tasks exist to chain dependencies or carry a key)`,
         )
       }
     }
@@ -852,6 +849,11 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       if (wsOutputs !== undefined) {
         validateWorkspaceGlobs(wsOutputs, `${where}.cache.outputs.workspaceFiles`, false)
       }
+      if (exec === undefined && (outFiles.length > 0 || wsOutputs !== undefined)) {
+        throw new UserError(
+          `${where}.cache.outputs: a task with no \`exec\` writes nothing — \`outputs: { files: [] }\``,
+        )
+      }
     }
   }
 }

package/src/workspace/migration.ts

@@ -261,6 +261,11 @@ export interface ApplyMigrationArgs {
    * and compiled the config into its dist (TanStack/query, 2026-09-11).
    */
   format?: MigrationFormat
+  /**
+   * With `dry`: one JSON document on stdout (`schemas/init.json`) in place
+   * of the files and the report, so an agent reads the plan as data.
+   */
+  json?: boolean
 }
 
 export type MigrationFormat = 'ts' | 'mjs'
@@ -360,11 +365,11 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
     const existing = metas.find((m) => m.dir === p.dir)?.configPath
     if (existing && existing !== path.join(p.dir, configName)) replaced.push(existing)
   }
-  if (dry) {
+  if (dry && args.json !== true) {
     for (const f of files) {
       process.stdout.write(`── ${f.relPath} ──\n${f.contents}\n`)
     }
-  } else {
+  } else if (!dry) {
     for (const f of files) await Bun.write(f.abs, f.contents)
     for (const f of replaced) await unlink(f)
   }
@@ -476,7 +481,29 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
     ...(inGitWorkTree(root) ? [] : ['git init']),
     ...(empty ? [`declare a task as the example shows`] : []),
   ]
-  report.push('', `next: ${steps.length === 0 ? run : `${steps.join(', ')}, then ${run}`}`)
+  const next = steps.length === 0 ? run : `${steps.join(', ')}, then ${run}`
+  if (args.json === true) {
+    process.stdout.write(
+      `${JSON.stringify({
+        dry,
+        source,
+        files: files.map((f) => ({ path: f.relPath, contents: f.contents })),
+        kept,
+        replaced: replaced.map((f) => relPosix(root, f)),
+        todos: [...todos].map(([reason, tasks]) => ({ reason, tasks })),
+        notes: [
+          ...(empty && unreached.length > 0 ? [unreachedHint(unreached, root)] : []),
+          ...(empty ? noMembers : []),
+          ...(args.notes ?? []),
+          ...plan.headerNotes,
+          ...plan.notes,
+        ],
+        next,
+      })}\n`,
+    )
+    return 0
+  }
+  report.push('', `next: ${next}`)
   process.stdout.write(`${report.join('\n')}\n`)
   return 0
 }

package/src/workspace/workspace.ts

@@ -165,6 +165,7 @@ export async function findWorkspaceRoot(
     `Could not find a workspace root in any parent of ${start} ` +
       `(looked for pnpm-workspace.yaml or package.json): run vx inside a project, ` +
       `or create a package.json (\`bun init\` or \`npm init -y\`) and run \`vx init\``,
+    'VX_E_NO_WORKSPACE',
   )
 }